deps: upgrade npm to 10.5.1

PR-URL: #52351
Reviewed-By: Luke Karrys <[email protected]>
Reviewed-By: Michael Dawson <[email protected]>
Reviewed-By: Mohammed Keyvanzadeh <[email protected]>
Reviewed-By: Marco Ippolito <[email protected]>
Reviewed-By: Ulises Gascón <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

Author: npm-cli-bot

deps/npm/bin/npm

@@ -41,8 +41,9 @@ if [ $? -ne 0 ]; then
   fi
   no_node_dir
 fi
+NPM_PREFIX_JS="$CLI_BASEDIR/node_modules/npm/bin/npm-prefix.js"
 NPM_CLI_JS="$CLI_BASEDIR/node_modules/npm/bin/npm-cli.js"
-NPM_PREFIX=`"$NODE_EXE" "$NPM_CLI_JS" prefix -g`
+NPM_PREFIX=`"$NODE_EXE" "$NPM_PREFIX_JS"`
 if [ $? -ne 0 ]; then
   no_node_dir
 fi

deps/npm/bin/npm-prefix.js

@@ -0,0 +1,30 @@
+#!/usr/bin/env node
+// This is a single-use bin to help windows discover the proper prefix for npm
+// without having to load all of npm first
+// It does not accept argv params
+
+const path = require('path')
+const Config = require('@npmcli/config')
+const { definitions, flatten, shorthands } = require('@npmcli/config/lib/definitions')
+const config = new Config({
+  npmPath: path.dirname(__dirname),
+  // argv is explicitly not looked at since prefix is not something that can be changed via argv
+  argv: [],
+  definitions,
+  flatten,
+  shorthands,
+  excludeNpmCwd: false,
+})
+
+async function main () {
+  try {
+    await config.load()
+    // eslint-disable-next-line no-console
+    console.log(config.globalPrefix)
+  } catch (err) {
+    // eslint-disable-next-line no-console
+    console.error(err)
+    process.exit(1)
+  }
+}
+main()

deps/npm/bin/npm.cmd

@@ -8,8 +8,9 @@ IF NOT EXIST "%NODE_EXE%" (
   SET "NODE_EXE=node"
 )
 
+SET "NPM_PREFIX_JS=%~dp0\node_modules\npm\bin\npm-prefix.js"
 SET "NPM_CLI_JS=%~dp0\node_modules\npm\bin\npm-cli.js"
-FOR /F "delims=" %%F IN ('CALL "%NODE_EXE%" "%NPM_CLI_JS%" prefix -g') DO (
+FOR /F "delims=" %%F IN ('CALL "%NODE_EXE%" "%NPM_PREFIX_JS%"') DO (
   SET "NPM_PREFIX_NPM_CLI_JS=%%F\node_modules\npm\bin\npm-cli.js"
 )
 IF EXIST "%NPM_PREFIX_NPM_CLI_JS%" (

deps/npm/bin/npm.ps1

@@ -17,8 +17,8 @@ if ($nodebin -eq $null) {
 }
 $nodedir = $(New-Object -ComObject Scripting.FileSystemObject).GetFile("$nodebin").ParentFolder.Path
 
-$npmclijs="$nodedir/node_modules/npm/bin/npm-cli.js"
-$npmprefix=(& $nodeexe $npmclijs prefix -g)
+$npmprefixjs="$nodedir/node_modules/npm/bin/npm-prefix.js"
+$npmprefix=(& $nodeexe $npmprefixjs)
 if ($LASTEXITCODE -ne 0) {
   Write-Host "Could not determine Node.js install directory"
   exit 1

deps/npm/bin/npx

@@ -41,9 +41,9 @@ if [ $? -ne 0 ]; then
   fi
   no_node_dir
 fi
-NPM_CLI_JS="$CLI_BASEDIR/node_modules/npm/bin/npm-cli.js"
+NPM_PREFIX_JS="$CLI_BASEDIR/node_modules/npm/bin/npm-prefix.js"
 NPX_CLI_JS="$CLI_BASEDIR/node_modules/npm/bin/npx-cli.js"
-NPM_PREFIX=`"$NODE_EXE" "$NPM_CLI_JS" prefix -g`
+NPM_PREFIX=`"$NODE_EXE" "$NPM_PREFIX_JS"`
 if [ $? -ne 0 ]; then
   no_node_dir
 fi

deps/npm/bin/npx.cmd

@@ -8,9 +8,9 @@ IF NOT EXIST "%NODE_EXE%" (
   SET "NODE_EXE=node"
 )
 
-SET "NPM_CLI_JS=%~dp0\node_modules\npm\bin\npm-cli.js"
+SET "NPM_PREFIX_JS=%~dp0\node_modules\npm\bin\npm-prefix.js"
 SET "NPX_CLI_JS=%~dp0\node_modules\npm\bin\npx-cli.js"
-FOR /F "delims=" %%F IN ('CALL "%NODE_EXE%" "%NPM_CLI_JS%" prefix -g') DO (
+FOR /F "delims=" %%F IN ('CALL "%NODE_EXE%" "%NPM_PREFIX_JS%"') DO (
   SET "NPM_PREFIX_NPX_CLI_JS=%%F\node_modules\npm\bin\npx-cli.js"
 )
 IF EXIST "%NPM_PREFIX_NPX_CLI_JS%" (

deps/npm/bin/npx.ps1

@@ -17,8 +17,8 @@ if ($nodebin -eq $null) {
 }
 $nodedir = $(New-Object -ComObject Scripting.FileSystemObject).GetFile("$nodebin").ParentFolder.Path
 
-$npmclijs="$nodedir/node_modules/npm/bin/npm-cli.js"
-$npmprefix=(& $nodeexe $npmclijs prefix -g)
+$npmprefixjs="$nodedir/node_modules/npm/bin/npm-prefix.js"
+$npmprefix=(& $nodeexe $npmprefixjs)
 if ($LASTEXITCODE -ne 0) {
   Write-Host "Could not determine Node.js install directory"
   exit 1

deps/npm/docs/content/commands/npm-audit.md

@@ -49,6 +49,13 @@ Registry signatures can be verified using the following `audit` command:
 $ npm audit signatures
 ```
 
+The `audit signatures` command will also verify the provenance attestations of
+downloaded packages. Because provenance attestations are such a new feature,
+security features may be added to (or changed in) the attestation format over
+time. To ensure that you're always able to verify attestation signatures check
+that you're running the latest version of the npm CLI. Please note this often
+means updating npm beyond the version that ships with Node.js.
+
 The npm CLI supports registry signatures and signing keys provided by any registry if the following conventions are followed:
 
 1. Signatures are provided in the package's `packument` in each published version within the `dist` object:
@@ -89,7 +96,7 @@ Keys response:
 - `scheme`: only `ecdsa-sha2-nistp256` is currently supported by the npm CLI
 - `key`: base64 encoded public key
 
-See this [example key's response from the public npm registry](https://registry.npmjs.org/-/npm/v1/keys").
+See this [example key's response from the public npm registry](https://registry.npmjs.org/-/npm/v1/keys).
 
 ### Audit Endpoints
 

deps/npm/docs/content/commands/npm-ls.md

@@ -27,7 +27,7 @@ packages will *also* show the paths to the specified packages.  For
 example, running `npm ls promzard` in npm's source tree will show:
 
 ```bash
-[email protected].0 /path/to/npm
+[email protected].1 /path/to/npm
 └─┬ [email protected]
   └── [email protected]
 ```

deps/npm/docs/content/commands/npm-search.md

@@ -91,6 +91,16 @@ Show the description in `npm search`
 
 
 
+#### `searchlimit`
+
+* Default: 20
+* Type: Number
+
+Number of items to limit search results to. Will not apply at all to legacy
+searches.
+
+
+
 #### `searchopts`
 
 * Default: ""